[GH-ISSUE #3254] seccomp with filter based on flags argument of syscall #2042

New issue

Closed

opened 2026-05-05 08:42:57 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 08:42:57 -06:00

Owner

Originally created by @s3rj1k on GitHub (Feb 27, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3254

Can firejail block Open syscall with only specific argument, like O_RDWR?

If not can you please suggest another approach, for testing purposes, that can block specific syscall argument when running arbitrarily elf?

Originally created by @s3rj1k on GitHub (Feb 27, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3254 Can firejail block `Open` syscall with only specific argument, like `O_RDWR`? If not can you please suggest another approach, for testing purposes, that can block specific syscall argument when running arbitrarily elf?

gitea-mirror closed this issue

2026-05-05 08:42:58 -06:00

gitea-mirror commented

2026-05-05 08:42:59 -06:00

Author

Owner

@topimiettinen commented on GitHub (Feb 27, 2020):

This would be doable with seccomp filters in general, as the filters have access to registers which contain system call parameters and then logical and arithmetic operations can be done with them. But Firejail constructs filters which can only block or allow system calls completely, finer control isn't available. You could modify Firejail to load your own seccomp filter to do that.

@topimiettinen commented on GitHub (Feb 27, 2020): This would be doable with seccomp filters in general, as the filters have access to registers which contain system call parameters and then logical and arithmetic operations can be done with them. But Firejail constructs filters which can only block or allow system calls completely, finer control isn't available. You could modify Firejail to load your own seccomp filter to do that.

gitea-mirror commented

2026-05-05 08:43:00 -06:00

Author

Owner

@s3rj1k commented on GitHub (Feb 27, 2020):

Hmm, thanks @topimiettinen

@s3rj1k commented on GitHub (Feb 27, 2020): Hmm, thanks @topimiettinen

gitea-mirror referenced this issue

2026-05-05 08:44:29 -06:00

[GH-ISSUE #3303] noroot removes all user groups, nogroups redundant #2073

gitea-mirror referenced this issue

2026-05-05 08:58:59 -06:00